Firebase Cloud Messaging

The FCM Architecture includes three components: FCM connection server, a Trusted environment with an application server based on HTTP or XMPP and cloud functionality, and a Client application. Sending and receiving messages require a secured environment or server to build, direct and send messages, and an iOS, Android or web client application to receive messages.[11] There are two types of messages developers can send with FCM; notification messages and data messages. Notification messages are messages displayed on the device by FCM and are automatically managed by the FCM SDK. Data messages are processed by the client application.[12] Therefore, Notification messages are used when the developer requires FCM to handle the notification display for the client applications. Data messages will be used when the developer requires the messages to be processed on the client application.

Firebase cloud messaging architecture

FCM can deliver target messages to applications via three methods: to a single device, to a device group or to devices which are subscribed to topics. Developers build and send targeted messages to a select group of users on the ‘Notification composer.’ [10] Messages sent with FCM are integrated with Google Analytics to track user conversion and engagement. [13]

The implementation process has two key components. First, a secure environment to send and receive messages is required for FCM or other application servers to facilitate message transaction. Second, a client application of possible types, iOS, Android or web (javaScript), which is also compatible with the selected platform service is needed.

The implementation path for FCM is initiated with the FCM SDK setup following the instructions prescribed for the decided platform. Following setup, the client application must be developed. On the client app, add message handling, topic subscription logic and other required features. During this step, test messages can also be sent from the Notifications composer. The application server is developed next to build the sending logic. The base server environment is created without code.[4]

Registration of the device and setting it up to enable message reception from FCM is first required. The client application instance will be registered and assigned a registration token or FCM Token, which is issued by the FCM connection servers that will provide the application instance (app instance) a unique identifier. The app instance is then able to send and receive downstream messages. Downstream messaging refers to the sending of a push notification from the application server towards the client application. This process involves four steps. First, after a message is created on the Notifications composer or in another secure environment, a request for the message will be sent to the FCM backend. Second, the FCM backend will receive and accept the message request and prepare the messages for each specified topic, create message metadata such as a message ID and send it to a transport layer, specific to the platform. Third, the message will be sent through the platform-specific transport layer to an online device. The platform-level transport layer is responsible for routing the message to a specific device, handling the delivery of the message and applying specific configurations to the platform. Fourth, the client application will receive the notification or message via their device. [14]

Firebase offers free and unrestricted analytics tools to assist the user gain insights into the 'ad click' & 'application usage' of end customers. In conjunction with other Firebase features, Firebase Analytics allows the user to explore and use on a range of functionalities such as click-through rates to app crashes.[15]

It is a simple key-value store that lives in the cloud and enables the user to implement modifications which can be read by the application. The Firebase Remote Config also includes an audience builder, in addition to the basic feature, which helps the user create custom audiences and perform A / B testing.[15]

APIs packaged into single SDKs for iOS, Android, JavaScript and C++ in conjunction with the cross-platform support provided by FCM allow the developer to expand across different platforms without infrastructure modification.[15]

Developers can implement the standard IETF Web Push APIs and being to target web browsers. On Chrome, developers can send messages to Chrome on Android or Chrome pages in Mac, Windows and Linux. Added features for web push support include Topic Messaging and the ability to send messages to Topic Combinations.[15]

Developers can send a single message to multiple devices. It is a method of notification to users with common interest topics such as sports events, artists, music genres. Developers need to publish a message to FCM, which is automatically delivered to devices subscribed to the select topic. Subscriber count on a single topic or multiple topics are not limited on the application.[15]

If users are subscribed to different topics, to prevent publishing the same message across different topics and users from receiving duplicate messages, developers can use the updated API. Developers can set specific conditions for FCM to deliver the message only to users who meet the condition criteria.[15]

Message Delivery Reports (MDR) are generated by FCM's reporting tool which allows developers to obtain analytical insights into the message delivery. In the MDR, developers can evaluate the reach of the sent messages to specific users by viewing the data for messages to different FCM SDKs (Android, iOS). [16]

A Notification Funnel Analysis (NFA) is built into the FCM platform. By using this tool, developers can view user behaviour and trends from data around responses to particular notifications. The types of notification data which can be analysed are "Notifications Sent", "Notifications Opened" and number of unique users. An analysis report can be pulled from the NFA. Developers can also customise and build the notification funnels. [16]

FCM shortens the design and implementation process for mobile applications. Due to the available functionality of sending test messages through the Notifications Composer in the Firebase console, the testing process is also shortened. Cloud-based messaging solutions also have security and privacy risks which need to be mitigated and considered before implementation into a project. The development of cloud computing involves an open network structure and elastic pooling of shared resources which increases the need for cloud security measures to be established.[17]

A security concern is the potential exploitation of server keys which are stored in the FCM’s Android application package (APK) files. If exploited, this allows the distribution of push notification messages to any and all users on the Firebase platform. GCM has previously reported security vulnerabilities where phishing and malicious advertisement activities have occurred.

Protection against security threats involves multiple steps and can lead to additional implications. Deactivating the Cloud Messaging service will prevent immediate transactions. However, this could potentially stop other applications installed on the blocked device which rely on the FCM service.[17] A possible solution is to block a specific notification channel or unsubscribe from a topic. Other solutions involve setting up message traffic notification systems to detect malicious information being messaged through the FCM service platform.[18] To implement this solution additional steps are required. The user needs to identify at the start, the connection channel or topic potentially used by the malicious application.

Cloud-based messaging also poses privacy risks and issues. Black hat hackers may be able to breach the security of the Firebase Cloud Messaging platform and acquire the registration ID of the user’s application or other sensitive information. Security compromise examples include private messages on a user’s social media account being pushed to the hacker’s device.To ensure the privacy of the platform, the user can build end-to-end protection schemes around the open communication channels provided by the Cloud Messaging Services, which are unsecure. FCM provides users with payload encryption.[17]